Security audit

Self Improving Agent.Tmp

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for self-improvement logging, but it can persist user and agent context into future sessions and broad agent instruction files without enough safeguards.

Review before installing. Prefer project-scoped hooks over global user-level hooks, avoid empty matchers unless you want every prompt affected, and require explicit review before writing to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions. Do not store secrets, personal data, raw transcripts, or raw tool output in .learnings, and avoid sessions_history or sessions_send unless the user has approved the specific source and destination.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:15
Finding: Untrusted conversational content can be promoted into persistent agent instruction files
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:15-26, SKILL.md:262-289, SKILL.md:440-448; related workflow in references/openclaw-integration.md:73-124
Vulnerability Type: Persistent agent memory poisoning
Risk Level: High

Vulnerable Code or Instructions

markdown
| User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` | | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) |

markdown
### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`

markdown
7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md

Technical Analysis

The workflow treats user corrections, task observations, and error context as candidate learning material and permits that material to be promoted into persistent instruction files such as CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, and .github/copilot-instructions.md.

These files are not ordinary audit logs. They are described as workspace prompt files that are injected into later agent sessions. The promotion process does not require explicit owner approval, provenance checks, separation of data from instructions, or sanitization of imperative content. Consequently, an attacker-controlled “correction” can be transformed into a durable agent rule.

The risk is amplified by the instruction to “promote aggressively,” which lowers the threshold for writ ...[truncated 1387 chars]
Remediation: View remediation
Remediation Suggestions

Never automatically promote conversational content into agent instruction files.

Require explicit, informed user approval for each target file and display the exact proposed diff before writing.

Store learnings in a dedicated data-only location that is not automatically interpreted as agent instructions.

Add provenance fields identifying the originating session, user, and approval status.

Reject or quarantine learning entries containing imperative instructions, tool commands, requests to override prior rules, or references to secrets.

Use a strict allowlist of factual fields that may be promoted, rather than free-form text.

Remove the “promote aggressively” instruction and require recurrence, independent verification, and maintainer review.

Provide rollback support and an audit trail for all modifications to persistent prompt files.

T01 · Skill Instruction Hijacking

Warning

Location: scripts/activator.sh:9
Finding: Hooks inject skill-controlled instructions into every prompt or agent bootstrap
Content: View full analysis
Vulnerability Details

File Location: scripts/activator.sh:9-18, hooks/openclaw/handler.js:8-48, hooks/openclaw/handler.ts:10-59
Vulnerability Type: Global prompt and bootstrap instruction injection
Risk Level: Medium

Vulnerable Code

bash
# Output reminder as system context cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. </self-improvement-reminder> EOF

javascript
const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); }

Technical Analysis

The prompt-submit hook emits instructions explicitly described as “system context.” The OpenClaw handler similarly inserts a virtual bootstrap file into event.context.bootstrapFiles. Once the optional hooks are enabled ...[truncated 1700 chars]
Remediation: View remediation
Remediation Suggestions

Do not present hook output as system context.

Replace global instruction injection with a user-visible, non-authoritative notification.

Activate learning capture only through an explicit user command or narrowly scoped task matcher.

Require confirmation before any file creation, append, promotion, or skill extraction.

Separate reminder text from trusted bootstrap files so it cannot be interpreted at the same trust level as workspace policy.

Disable user-level global installation by default and clearly disclose the full behavioral scope before activation.

Add tests confirming that unrelated prompts do not trigger learning writes or persistent context changes.

other

Warning

Location: references/openclaw-integration.md:159
Finding: Workflow encourages reading and propagating data from unrelated sessions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:87-92, references/openclaw-integration.md:159-186
Vulnerability Type: Cross-session transcript access and information propagation
Risk Level: Medium

Vulnerable Instructions

markdown
OpenClaw provides tools to share learnings across sessions: - **sessions_list** — View active/recent sessions - **sessions_history** — Read another session's transcript - **sessions_send** — Send a learning to another session - **sessions_spawn** — Spawn a sub-agent for background work

markdown
### sessions_history Read transcript from another session:

sessions_history(sessionKey="session-id", limit=50)

text
### sessions_send Send message to another session:

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

text

Technical Analysis

The skill advertises transcript reading and cross-session messaging as part of its learning workflow, although local learning capture does not require access to unrelated sessions. No consent requirement, session allowlist, data classification, secret redaction, or trust-boundary guidance is provided.

Session transcripts can contain private user information, credentials printed during debugging, proprietary code, or adversarial instructions. Copying transcript-derived material into .learnings/ or prompt files can create both confidentiality exposure and persistent prompt poisoning.

The audited project does not itself invoke these tools automatically. The risk arises from the documented agent behavior and the unnecessary expansion of the workflow’s data-access scope.

Attack Path

The agent follows the documented inter-session workflow and lists active or recent sessions.

It reads a transcript from another session using sessions_history.

The transcript contains sensitive information or attacker-authored instructions.

The agent classifi ...[truncated 789 chars]
Remediation: View remediation
Remediation Suggestions

Remove sessions_history from the default learning workflow.

Require explicit user authorization naming the source session and intended destination before transcript access.

Limit access through session allowlists and least-privilege tool policies.

Redact credentials, tokens, personal information, and proprietary content before storage or forwarding.

Treat all transcript content as untrusted data and prohibit direct promotion into instruction files.

Record provenance and consent metadata for any cross-session learning.

Prefer user-authored summaries over direct transcript retrieval.

T09 · Insecure Skill Coding Practices

Note

Location: hooks/openclaw/handler.ts:39
Finding: JavaScript runtime handler omits the sub-agent exclusion implemented in TypeScript
Content: View full analysis
Vulnerability Details

File Location: hooks/openclaw/handler.ts:39-43; corresponding guard is absent from hooks/openclaw/handler.js:27-49
Vulnerability Type: Security-relevant source and runtime divergence
Risk Level: Low

Divergent Code

The TypeScript source contains this exclusion:

typescript
// Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; }

The shipped JavaScript proceeds directly from context validation to injection:

javascript
// Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); }

Technical Analysis

The JavaScript and TypeScript implementations are not behaviorally equivalent. TypeScript excludes session keys containing :subagent:, while JavaScript injects the reminder into any valid agent:bootstrap event with a bootstrapFiles array.

If the platform executes handler.js, reviewers relying on handler.ts may incorrectly conclude that sub-agents are excluded. This is a security-relevant build and release integrity issue because it broadens the scope of instruction injection.

Attack Path

The OpenClaw installation loads handler.js as the runtime entry point.

A sub-agent receives an agent:bootstrap event.

The JavaScript handler validates the event and context.

Because the sub-agent guard is absent, it appends SELF_IMPROVEMENT_REMINDER.md.

The sub-agent receives instructions that the TypeScript source appear ...[truncated 492 chars]
Remediation: View remediation
Remediation Suggestions

Maintain one authoritative source implementation.

Generate JavaScript from TypeScript through a reproducible build rather than editing both files independently.

Add parity tests that execute both handlers against main-agent and sub-agent bootstrap events.

Add the sub-agent exclusion to the shipped JavaScript immediately if JavaScript remains a supported entry point.

Declare the runtime entry file explicitly in hook metadata or installation documentation.

Fail the release process when generated JavaScript differs from the compiled TypeScript output.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill is for recording and reviewing learnings, corrections, failures, and outdated knowledge to enable continuous improvement. The supplied code does not implement that behavior. Instead, it is a project scaffolding utility that creates a new skill folder and a templated SKILL.md file from a skill name. While it mentions 'learning entry' in comments and template text, it does not capture, persist, review, or analyze learnings/errors/corrections as described. Its primary purpose is materially different: skill extraction/scaffold generation, including filesystem writes, argument parsing, and path validation.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Directing users to modify ~/.claude/settings.json touches a sensitive agent configuration directory that controls persistent behavior. In the context of shell-command hooks, changing this file can establish durable code execution across future sessions, making it a high-risk persistence mechanism if misused or later altered.
Content: Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.
Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.
sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description and early guidance are broad enough that an agent may invoke it in many ordinary situations, causing unnecessary writes to persistent memory files. In an agent environment with automatic skill loading or hooks, over-triggering increases the chance of recording sensitive or irrelevant conversation data without clear user intent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill directs creation of persistent workspace storage under ~/.openclaw/workspace/.learnings, which establishes session-to-session memory outside the immediate task. Persistence is not inherently malicious, but in this context it increases privacy risk because other parts of the skill encourage broad logging and later review/sharing of that retained data.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
└── FEATURE_REQUESTS.md

text
### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly supports inter-session sharing of learnings and reading other session history, but it does not define data-minimization, consent, or redaction requirements. In practice, this can propagate sensitive conversation content across sessions and broaden access beyond the original task context.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The logging format instructs the agent to store full context, inputs, parameters, and user context in persistent markdown files. Those fields can easily capture secrets, personal data, internal paths, access tokens, or sensitive business information, creating a durable data-retention risk that may later be indexed, synced, or exposed.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The promotion workflow encourages copying learnings into long-lived agent context files such as CLAUDE.md, AGENTS.md, SOUL.md, and Copilot instructions. If a learning contains user-derived sensitive information, promotion turns a localized retention issue into broad and repeated propagation across future sessions and agents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The automatic logging triggers rely on very common conversational phrases like corrections and feature wishes, which can be encountered in normal chat and may cause routine user statements to be persisted. That creates a privacy and integrity risk because the agent may over-collect user-provided content and treat transient discussion as durable memory.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.
When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 83% confidence
Finding: The guide instructs users to add persistent hook configuration to .claude/settings.json, which survives across sessions and continuously alters agent behavior. Persistence is especially relevant here because the hooks execute shell scripts, so the effect is not just instructional but operational and recurring.
Content: Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.
Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: An empty matcher causes the hook to fire on every prompt, creating an always-on execution path for the referenced shell script. In a self-improvement skill, that broad trigger increases the blast radius of any script bug, prompt-context leakage, or later tampering with the script file.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guidance recommends putting hook configuration in ~/.claude/settings.json for global activation without strong restrictions, which enables command-hook execution across all sessions and repositories. That persistence and scope make any unsafe script behavior, path hijack, or later file modification substantially more dangerous.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Codex configuration repeats the empty matcher pattern, causing the command hook to run for every prompt. This broad trigger unnecessarily increases exposure to command execution and context processing in all interactions instead of only relevant error/debug workflows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document's security section claims the scripts only output text and do not run commands, yet the setup explicitly configures them as command hooks executed by the agent. This contradiction can mislead users into underestimating execution risk, causing them to install and trust shell-based hooks with the agent's privileges.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: Creating a persistent .learnings/ directory is not inherently unsafe, but in a self-improvement skill it establishes a mechanism for retaining potentially sensitive operational history across sessions. Without retention limits, access controls, or guidance on safe content, this persistence can accumulate secrets, user data, or internal context that later sessions or users may access.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.
openclaw hooks enable self-improvement

text
### 3. Create Learning Files Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation directs users to log learnings to persistent workspace files and promote them into shared context files without any guidance to avoid secrets, personal data, or sensitive prompts. In a self-improvement skill, failures and corrections often contain API errors, credentials-adjacent details, internal file paths, or user content, so persisting them can create unintended long-term data retention and secondary disclosure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The cross-session features are presented as normal workflow tools, including reading transcript history and sending messages, but the documentation does not warn that these actions can expose sensitive context across sessions. In this skill's context, learnings may include errors, tool outputs, or user corrections, so cross-session sharing increases the attack surface for inadvertent disclosure or prompt-context leakage.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The usage text and overall flow show this file is meant to create a new skill from a learning entry, including directory creation and template generation. Creating new skills is not an obvious requirement of a skill whose declared purpose is to capture learnings, errors, and corrections for continuous improvement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes a skill focused on recording learnings, errors, corrections, and reviewing them before major tasks. This helper instead scaffolds an entirely new skill directory and writes a new SKILL.md file, which is a separate code-generation/project-creation capability rather than simply capturing or reviewing learning entries.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code or Instructions

Technical Analysis

Remediation Suggestions

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

other

Vulnerability Details

Vulnerable Instructions

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Divergent Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Agent Config Directory Access

Option 2: User-Level Configuration

Exfiltration Commands

sessions_send

Vague Triggers

Session Persistence

Ssd 3

Ssd 3

Ssd 3

Vague Triggers

Skill Enumeration

Session Persistence

Option 1: Project-Level Configuration

Vague Triggers

Vague Triggers

Vague Triggers

Intent-Code Divergence

Session Persistence

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Description-Behavior Mismatch